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INTRODUCTION 


Human behavior is generally believed to be responsible for a sub- 
stantial majority of both fatal and non-fatal aircraft accidents through- 
out the world. The social and economic costs of these accidents are 
high and rising rapidly despite comparatively low overall accident rates. 

If further progress is to be made in the field of aircraft accident pre- 
vention, it is imperative that a concerted effort be directed at accidents 
and other anomalies caused by human error. 

It has long been recognized by aviation safety workers that the 
attribution of an accident or incident to "pilot error" leaves unanswered 
the question of why the error was conmitted. Yet attempts to answer 
this most difficult question have often been thwarted by a lack of evi- 
dence, especially in fatal accidents. The investigation of incidents 
has been somewhat more productive, but even here, problems related to legal 
liability and punitive measures have inhibited the free flow of information 
regarding the possible reasons why an error occurred. 

As a result, we do not have a clear understanding of the factors 
which cause even well-trained, professional pilots to become involved in 
errors at critical points in flight. Neither do we understand, except 
in isolated cases, the factors which may oe responsible for their failure 
to recognize and react to presumably clear warnings, or to intervene under 
circumstances which seem to clearly require such intervention. We lack, 
in short, understanding of the microstructure of human behavior in the 
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aviation environment, and thus an understanding of the causes of human 
errors in that environment. 

In an effort to gain a better understanding of these problems, a 
small group of interested aviation workers began to meet and discuss them 
in November, 1973. The group included professional pilots, flight sur- 
geons, psychologists and engineers, all active in the field of aviation 
safety. The meetings were held under the auspices of NASA's Ames Research 
Center. 

The group has attempted to examine the range of human and system 
problems which may be associated with human errors in aircraft operations. 
This working paper is an outgrowth of that examination. Its intent is to 
provide a structure and format within which systematic and comprehensive 
investigations of behavioral problems in aircraft operations can be 
undertaken. 

The paper has three sections. The first examines the conceptual 
framework of our investigative method. It attempts to characterize huma-. 
behavior in terms which can lead to an understanding of why that behavior 
may have occurred. 

The second section is a guide for interviewers who may have occasion 
to collect information from pilots or others in the system who have observed 
an occurrence involving human factors or human errors . The section seeks to 
help the interviewer to inquire systematically into all of the system and 
other factors which may have been related to the occurrence under study. 



The third section introduces a classification system which wo have 
developed in order to derive general conclusions from our examination of a 
considerable number of reports of occurrences, incidents and accidents in 
air transportation. It is provided to help those who may collect such data 
to understand the necessity for comprehensive inquiry into each such event. 
ThiB section is not an exhaustive explanation of the classification scheme, 
which is described more fully in an annex to the working paper, available on 
request from the authors.* 


We have chosen to publish this preliminary working paper at this time 
in the hope that our colleagues in the aviation safety field will examine it, 
criticize it and share with us their suggestions for its improvement. Their 
comments will be welcomed by the authors and will be acknowledged in future 
revisions . 


William Barnhart 
Charles Billings 
George Cooper 
Rod Gils trap 
John Lauber 
Harry Orlady 
Bert Puskas 
Warren Stephens 

*: Requests and comments may be directed to: 

Charles E. Billings, M.D. 

Man-Machine Integration Branch, 239-3 
NASA-Ames Research Center 
Moffett Field, California 94035 
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GLOSSARY 


The following definitions describe the specific meanings of a number 
of terms used in this working paper. The sources of many of the defi- 
nitions ate given. 

ACCIDENT: An occurrence associated with the operation of an aircraft 

which takes place between the time any person boards the air- 
craft with the intention of flight until such time as all 
such persons have disembarked, in which any person suffers 
death or serious injury as a result of being in or upon the 
aircraft or by direct contact with the aircraft or anything 
attached thereto, or the aircraft receives substantial damage. 

ANOMALY: A deviation from the common rule; an irregularity. As used 

here, an anomaly is a departure from normal or expected per- 
formance in the course of a mission. The departure from nor- 
mal operation may be that of the airplane, including its com- 
ponents, its crew or others concerned with the direction and 
control of aircraft. Synonym: Operational anomaly. A 
behavioral anomaly is a departure from normal or expected 
performance of some person — an error. Carl Lager's term 
"dysfunction" — an unwanted result of operation, an unwanted 
system state or unwanted component response — is analagous. 

BACKGROUND: This term includes all relevant activities to the conduct of 
a mission which take place prior to the beginning of a flight. 
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ERROR: 


An act involving a departure from. .. accuracy ; a mistake. 

FACTOR: One of the elements that contribute to produce a result; a 

constituent. 

FACTOR, ASSOCIATED: An element which is present in the history of an 

anoimly and which is pertinent to the occurrence under study, 
Lut which does not fulfill the requirements of an enabling 
factor. 

FACTOR, ENABLING: An element which is present in the history of an 

anomaly and without which the anomaly probably would not 
have occurred. 

FLIGHT: A flight begins when an airplane's engines are started, or 

when it is moved from its blocks for the purpose of under- 
taking a mission. It ends when the airplane is parked at 
its blocks and engine shut-down is complete, or when it comes 
to rest following an impact with the surface of the earth. 

FUNCTION: A distinctive process or activity; a useful activity. As 

used here, a specific class of behavior. 

INCIDENT: An unwanted occurrence less serious than an accident, which 

involves any of several specific classes of occurrence: 

Flight control system malfunction or failure; 

Inability of a flight crew member to perform his 
duties because of injury or illness; 

Turbine engine rotor failures of certain types; 

In-flight fire; 

Aircraft collide in flight. 
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MISSION! 


This term refers to the composite of pi] *t and vehicle functions 
which must be performed to fulfill a Lven set of operational 
requirements. Those operational requirements impose the 
boundaries on expected operation during a flight. 

POST-ANOMALY; This term includes all activities related to the conduct of 
a mis r ,ion which occur after an anomaly and prici to the end 
of a flight. 

POST-FLIGHT; This term includes all activities related to the conduct of a 
mission which take place subsequent to a flight. It includes 
post-crash rescue and survival efforts. 

PRE-ANOMALY : This term includes all relevant activities from the beginning 
of a flight to the occurrence of an anomaly. 

PRE-FLIGHT; This term includes all activities relevant to a mission which 
occur prior to the beginning of the flight. 

PROCESSING: The act of making a decision. 

STRESS: Any element in the environment of man which evokes a response. 

SUBSYSTEM; A complex of aircraft components, as: electrical system, hyd- 
raulic system, etc. 

SYSTEM, AVIATION: The total complex of persons, components and facilities 
involved in the movement of persons and cargo by air. 
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1. TASK ANALYSIS IN THE STUDY OF HUMAN FACTORS IN AIRCRAFT OPERATIONS 


The immediate goals of a human factors study of an aircraft anomaly, 
incident or accident are to discover, first, what role human behavior may 
have played in the causal chain of (vents, and second, to discover why the 
people ir. ..ie system behaved as they did. The ultimate objective of such 
a study is to develop measures which can be used to prevent a recurrence of 
inappropriate behavior, or to minimize the effects of such behavior on the 
safety of the operation. 

One way to approach these objective., is described in this working paper. 
Nearly all studies of aircraft incidents and accidents involve the construc- 
tion of a chronology, or time line, which describes each significant event 
known to have occurred prior to the incident, and if appropriate, after- 
ward. We also construct such a chronology, with particular emphasis on 
the behavioral events, relating them as closely as possible to all other 
events in the sequence. in this process, we attempt to discover or infer 
what effect the behavioral events may have had upon the sequence, and also 
what external events may have motivated a particular behavior. We call 
this process a function analysis . It is described in more detail below. 

It should be noted that the function analysis must encompass the behavior 
of all of the people concerned with a particular occurrence, not merely 
the pilot or cockpit crew. 

The function analysis can often help to demonstrate the role which 
human behavior played in the causation of the incident under study. 
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In non-catastrophic incidents, it can also help to demonstrate what be- 
havioral events may have aided the recovery of the system after the 
deviation occurred. It cannot, however, provide a full insight into why 
the people in the system behaved as they did. We therefore include a 
second, parallel analysis J.n our study of these occurrences . This is called 
an information processing analysis , in this part of the study, one examines: 

a. the sources of information available to each person involved in 
the occurrence; 

b. which information was perceived and used and in what ways; 

c. what decisions were arrived at from the alternative choices 
available, and 

d. whether the actions taken were in consonance with the decisions. 

The information processing analysis can often help to demonstrate 
why the various people in the system acted as they did. Equally important, 
it can often demonstrate what actions must be taken to prevent a recurrence 
of inappropriate behavior, or to minimize the potential impact of such 
behavior on system safety. These actions may involve any one of the many 
elements in the aviation system, or a number of them. 

The Function Analysis 

As used here, the term "function" describes a set of tasks which 
shares a common subsystem goal and encompasses a common category of behaviors. 
Table 1 shows the functions considered necessary to fulfill mission object- 
ives in civil aircraft operations. 
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Table Is BEHAVIORAL FUNCTIONS IN AIRCRAFT OPERATIONS 


FUNCTION 


1 

SUBSYSTEM GOAL j 

CATEGORY OF BEHAVIORS 

INTELLECTUAL FUNCTIONS: 


Acquisition of information 
regarding the position or 
status of the aircraft, the 
system and the environment. 

1 

i 

Attention to external objects, 
perception of information, 
awareness of that information, 
^ appreciation of the implica- 
tions of the information. 

1 

Selection of rules and of 
actions with which to impl*- 
ment the assigned mission. 

Decision-making, concept form- 
ation, problem-solving, 
management skills. 



IMPLEMENTATION FUNCTIONS: 


FLIGHT or GROUND 
HANDLING 

C-nf.rol of the airplane’s 
s ide and position in 
apace and time. 

Closed-loop manual tracking 
of airspeed, attitude, direc- 
tion and altitude. Percep- 
tual-motor skills. 

SUBSYSTEM OPERATION 

Operation of aircraft or 
i ground-based subsystems in 
order to implement a 
decision. 

Sequential discrete operation 
of switches and other con- 
trols; implementation of mem- 
orized or written procedures. 

SUBSYSTEM MONITORING 

Detection and identifica- 
tion of undesired subsys- 
tem states. 

Monitoring behavior; 
scanning; vigilance. 

COMMUNICATIONS 

BEHAVIOR 

Transmission ai.d reception 
of information. 

Verbal and non-verbal 
communications skills. 


Cognitive behavior is listed first in the table to indicate its priority among 
the functions. Cognition encompasses the behaviors by which a person becomes 
aware of, and obtains knowledge about, his relationship to his environment. 

In aviation, the flight crew and certain others (air traffic controllers, 
dispatchers) must all have knowledge of an airplane's location, status and 
intentions. Cognition is the process whereby each person acquires and 
appreciates this information. 
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Having become cognizant of the required information, each of the 
persons in the aviation system is in a position to do something about it. 
The process involved is called decision-making . A decision is the formu- 
lation of a course of action (from among a limited number of alternatives) 
with the intent of executing it. A decision may, of course, be to allow 
things to continue as they are: to do nothing. The process of decision- 
making is considered in more detail in the following section. 

The execution, or implementation, of a decision involves one or more 
a ‘-ions. The remaining functions in table 1 may be th-ught of as 
Implementation functions : the actions one takes to implement a decision. 

In a sense, they all involve the same goal,- they are separated, however, 
because they represent fundamentally different categories of behavior. 

A simple example may help to illustrate the functions as they apply 
to aircraft operations. Approaching an airport in a terminal area, a 
pilot may become cognizant that the visibility is excellent and that 
there are few aircraft operating in the area. Based on his appreciation 
of the implications of this information for his on-time arrival, the 
pilot may decide to "cancel IFR" and to complete his flight by visual 
flight rules, an alternative mode of operation open to him. 

Execution of this decision will require the use of some combination 
of the four implementation functions? it is important to note that the 
nature of the decision determines the appropriateness of the tasks which 
comprise the implementation functions. For example, certain subsystem 
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operation tasks which were appropriate when operating under IFR are no 
longer appropriate when the decision to proceed under VFR has been made. 

In implementing this decision, the pilot must communicate his inten- 
tions to his crew and to the air traffic controller handling his flight. 

He must select and communicate on the radio frequencies appropriate to 
VFR operations (subsystem operation) . He must continue tc; monitor the 
status of his aircraft and must also monitor the environment for con- 
flicting traffic. He may elect to control the airplane manually (flight 
handling) or he may perform this function through the autopilot (subsystem 
operation) . 

The human factors investigator must consider what decisions h? ,T e been 
made in order to evaluate properly the "correctness" of the resultant 
behavior — the performance of the implementation functions. Conversely, 
changes in the airplane's position or status caused by the performance of 
:hese implementation functions generate signals on instruments, etc., 
which are perceived, appreciated and become the basis for further decisions. 
This interdependence of the various functions is the principal reason why 
the function analysis, or behavioral chronology, must be as complete as 
possible. The development of a comprehensive behavioral chronology is 
aided immeasurably by the presence and cooperation of the flight crew, 
for in their absence the investigator must often resort to inferences in 


place of facts. 


In summary, the function analysis is used to develop a chronology of 
the significant behavioral events in an incident or accident sequence, and 
to structure that chronology in such a way thai behavioral events can be 
related to the occurrence of other significant events in the time line. 

The Information Processing Analysis 

The first part of a human factors study is concerned with what hap- 
pened in the course of an aircraft anomaly, incident or accident. The 
second, equally important, part of such a study must be concerned with 
why it happened: specifically, with why the people involved in the occur- 
rence behaved as they did. 

If we accept the proposition that there is some reason for all human 
behavior (and we do) , we may proceed to search for the reasons for each 
significant behavioral event listed in our function analysis. We have 
already indicated that each action by the pilot or others in the system 
represents an attempt to implement a previous decision. To structure 
our thinking about cognitive and decision-making behavior, we have devel- 
oped an information processing model of behavior (figure 1) . The model 
is singly a schematic way of locking at actions and the decisions which 
led to them. 

Briefly, the model says that, in order to accomplish any task, a 
pilot must first seek and acquire information from whatever sources are 
available. H-;*. must then make some determination regarding the quantity, 
and the quality, of the information he has gathered. Previously 
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Figure 1 
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gathered knowledge, contained in his memory, will influence the determi- 
nation of whether he has enough information, of high enough quality, to 
allow him to proceed. Psychological or environmental stress can also 
influence his evaluation of the information. 

Having determined that he has enough information, and that it is 
reasonably reliable, the pilot must then process these data in predetermined 
ways {again based on memory) in order to reach a wise decision from a 
limited number of alternatives. Before he finally accepts the decision 
he has made, however, he will make some judgement as to the acceptability 
of the "candidate decision" in terms of its potential impact upon the 
likelihood of successful mission completion. If the decision is finally 
accepted, the pilot selects the ways in which he will implement it, and 
then takes appropriate action. 

A large part of this process involves the pilot's judgement of 
probabilities: he is attempting to make wise decisions, often in the face 
of uncertainty. in addition, he must consider cost and safety tradeoffs, 
and there is good evidence that all of these factors do influence decision- 
making in the aviation system. 

Consider a hypothetical example. "The information I am receiving 
from my instruments indicates that I am on profile, and at decision height. 
The view outside the windscreen indicates that I do not have enough visi- 
bility to complete the landing. Standard operating procedures therefore 
dictate that I should execute a missed approach..." {figure 2). 
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Figure 2 


























"The KVR has been at or above minimums, however; this approach path 
is a clear one with a long runway, and the visibility below the cloud baso 
is good. In addition, I've just spent 20 minutes in a holding stack to 
which I'll have to return if I overshoot, and this will cost us considerable 
time and fuel. Since the information I have indicates that the visibility 
will become adequate at a safe altitude, I'll continue a little further 
before deciding to Overshoot,.." 

We do not mean to imply by this example that pilots verbalize their 
decisions in this way, nor that the decision to continue is motivated in 
this manner. We do suggest, however, that this sequence of information 
acquisition, evaluation, processing and decision selection does take place. 

In order to understand the behaviors involved in an occurrence, we 
must ask the following questions about each behavioral events 

1. Was all necessary and pertinent information acquired by the pilot 
(or controller, or dispatcher, etc.)? Was the information he acquired 
correct? Was it in a format which he could assimilate in the time 
available to him? 

2. Was the information properly evaluated: 

a. with respect to quantity (was there enough information)? 

b. with respect to quality (was it consistent and reliable)? 

3. Was the information properly processed: did the pilot reach an 
appreciation of the true state of affairs? 

4. Did the pilot select the safest and wisest decision (based on the 
information available to him) from among the available alternatives? If 
not, what other- factors entered into his decision? 

5. Was the decision effectively implemented once it was made? 
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An illustration of the use of the information processing analysis may 
be of help in understanding its utility. This case is taken from an 
incident which occurred several years ago in general aviation. 

Situation : A qualified pilot returning from a vacation in northern 

Wisconsin in a rented Beech Travel-Air encountered a double engine failure 
due to fuel exhaustion five miles short of his home airfield in Ohio. He 
landed gear-up in a farm field; the airplane was extensively damaged, but 
there were no injuries. Because of approaching severe weather at his 
takeoff point, the pilot had performed a hurried preflight procedure and 
had made only a cursory check of terminal weather. 

After collecting data for the function analysis and preparing a 
chronology of pertinent behavioral events, the investigator might attempt 
to analyze the pilot's behavior in this way: 

1. Did the pilot acquire all necessary and pertinent information 
prior to making a decision or performing critical actions? 

With respect to the pilot's decision to fly non-stop: was he aware of 
the distance to be covered? Did he know the winds aloft? Was he familiar 
with fuel consumption data for various power settings? Did he determine 
fuel quantity during preflight? How? 

2. Did he properly evaluate the sufficiency and quality of the 
information he acquired? 

Fuel gauges in light aircraft are notoriously inaccurate. Did he 
verify his fuel gauge readings by visual inspection of the tanks? Did 
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he make use of time-distance checks early in the flight as a check on winds 
aloft? Had he verified the airplane operating manual data on fuel consump- 
tion during previous flights? 

3. Was the information properly processed? Did the pilot 
appreciate the true state of affairs? 

Did the pilot know how to transform fuel quantity into aircraft range? 
Did he take altitude, air temperature and other factors into account in 
arriving at a most efficient plan for flight management? Did he know about 
and use economy cruise techniques? 

4. Did the pilot select the safest decision, based on the 
information he had, from among the alternatives open to 
him? 

It might be said that the answer to this question is obviously "no", 
in view of the outcome of the flight. This answer may not be correct. 

If the information available to the pilot from the sources he used was 
incorrect it is quite possible that his decision, based on the information 

he had, was an entirely appropriate one. He knew, as an instance, that 

|? 

i" 

the safest decision was to take off as expeditiously as possible, given 
approaching severe weather at his point of departure. One must not make 
the mistake of accepting an outcome as "obvious" evidence of an error. This 
question can only be answered if answers to the previous questions are 
available . 

5. Was the decision properly implemented once it was made? 
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Once again, the answer to this question depends on the answers to the 
previous ones. Given that hiB decision waB that it was quite safe to con- 
duct a nonstop flight, did he use the best power settings for economy cruise? 
Did he manage other airplane subsystems (cowl flaps, for instance) so as to 
achieve maximum range? Perhaps most important, did he have in mind a con- 
tingency plan or alternate course of action in the event of fuel consumption 
greater than planned, or winds less favorable than forecast? 

Depending on the answers to these questions, the investigator might 
decide that the primary enabling r uetor in this incident was lack of 
knowledge, or unfamiliarity with the airplane, or the stress posed by 
the threat of weather, or defective judgement because of the pilot's 
desire to get home, or any of several other pilot-related factors. It 
is equally possible, however, that after reviewing all aspects of this 
incident, the investigator might learn that the airplane operating manual 
did not contain sufficient information, or that the fuel gauges read 
systematically high as tanks neared the empty level, or that the winds 
aloft forecast was wrong, or that this particular airplane had much 
higher fuel consumption than the manual figures indicated, or any of 
several other factors over which the pilot had no significant degree of 
control. In this event, the investigator might well reason that what 
had appeared to be an obvious "pilot error" was, in fact, a system prob- 
lem which led the pilot to an incorrect decision, and therefore an 
incorrect course of action. 
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The investigator's judgement as to the most probable reasons for 
the pilot's behavior will suggest possible solutions designed to make 
such incidents less likely in the future. it is possible that the pilot 
simply did not understand the relationship of density altitude and other 
factors upon his airplane's range and fuel consumption. More adequate 
training with respect to cross-country flight planning may be needed# 
not just for this pilot, but for many others. It is also possible, 
however, that more accurate fuel gauges, or an accurate fuel flow meter 
or totalizer, or better manuals, might have provided this pilot with the 
only information he lacked in order to have made the flight safely. 

By systematically considering all pertinent data, the human factors 
analyst should arrive at a "most probable" <;.;;planation of each of the 
significant behavioral events identified in the function analysis. The 
necessary inputs for this analytic process include the possible effects 
of stress upon the decision-making and implementation processes, and 
the pre-existing knowledge, resident in memory, of the pilot or other 
person whose behavior is under study. 

To repeat, it is obvious that there is no really effective substi- 
tute for information furnished by persons involved in an occurrence. 

Given the proper atmosphere, detailed information of this sort can be 
provided, and the investigator can substitute knowledge for supposition 
in his effort to understand the behavior he is studying. The following 
section discusses methods of obtaining such detailed data from persons 
in the aviation system. 
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2. THE COLLECTION OF HUMAN FACTORS DATA IN AIRCRAFT OPERATIONS 


This section was prepared as an aid to investigators who participate 
in the collection of human factors data from persona working in the avia- 
tion system. It explains the reasons for collecting such data and suggests 
methods for systematic data-gathering. It contains an introduction, a 
human factors outline, an interviewer's checklist and a sample interview. 


Documented studies show that deviations from normal or expected per- 
formance, often dismissed simply as "pilot error", occur frequently in 
operational flying. These deviations or errors are frequent „y cited, 
correctly or incorrectly, as the causes of aviation accidents. In the vast 
majority of cases, however, they do not appear to affect seriously the 
safety of flight unless other factors are present. We know little about 
why these deviations or errors occur and little about the factors which 
affect their hazard potential. Operationally relevant human factors data, 
carefully collected and analyzed, can provide answers to many questions 
in this area. 

There is a need to know much more about the factors involved in the 
chain of events which leads from normal performance to a deviation, an 
incident or an accident. It is necessary to learn precisely vhat behav- 
ior occurred and why it occurred. It is vital to learn which factors in 
any part of the system affected that behavior. Then, and only then, can 
we begin to have confidence in measures developed to reduce the incidence 
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of errors and in measures developed to minimize the effect of errors on 
air safety. 

Pilots , air traffic controllers and flight dispatchers are the people 
most likely to observe problems which affect the safety and efficiency of 
aircraft operations. Their reports must be a key part of any study of 
human factors and aviation safety. Their professional judgements as to 
system operation and critical safety problems are invaluable. With the 
help of an interviewer who understands both human factor data requirements 
and the aviation system, they will frequently be able to recall the per- 
tinent details of specific occurrences, the factors involved and, in some 
cases, the root causes. 

An interviewee may wish to discuss a specific incident or to make 
general observations regarding hazards in the system. If he presents 
general observations, the interviewer should try to secure specific 
examples, How did a particular factor create a threat to air safety and 
what might be done to reduce it? In some cases, even after discussion, 
you may believe that the factors he identifies are not the basic cause of 
his concerns. Regardless of your evaluation, it is important to be sure 
that the interview report reflects his undirected opinion. 

If an interviewee wishes to discuss a specific incident, he should 
be allowed to tell his story. The objective is to learn how this pro- 
fessional person perceived an occurrence which he believes is important 
enough to discuss. in most cases, questions to help him recall additional 
details should be asked only after he has been permitted to tell his story. 
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Any such questions should be non-leading; that is, t’ ey should not suggest 
an "ejected" answer. This is sometimes difficult. In moat cases, the 
interviewer may be able to suggest reasonable alternatives. If this 
technique is used, he should offer more than one alternative if possible, 
and make it clear that there may be others. 

Incident reports should include the exact sequence of events which 
led up to and followed an operational anomaly; the point at which the 
first departure from normal or expected performance occurred. They should 
also include a clear description of the observations, decisions, resulting 
actions, further observations and subsequent decisions which went on before, 
during and after the deviation. The event may have preceded and precipi- 
tated the observation that a threat to safety occurred, or it may be the 
reason the report is given. All factors which may have contributed bo 
the occurrence should be documented, including their location in the cock- 
pit, on the ground or elsewhere in the system. It is important to learn 
what the person reporting believes caused the problem, what factors he 
believes contributed to it, what things he feels might have prevented it, 
and what things he believes prevented it from developing into a more 
critical incident. 

Accidents have been defined as "occurrences from which complete recov- 
ery did not occur". Therefore, it is as important to learn exactly how 
the flight crew recovered from a deviation as it is to learn how and why 
it happened. Effective methods of controlling unanticipated problems are 
an essential part of aviation safety. 
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When an interview is completed, the interviewer should haves 

1. A clear understanding of what happened, why the person reporting 
believes it happened, what was done to correct the situation and how he 
believes the occurrence might have been prevented} 

2. Sufficient information to be able to construct a chronological 
description (the function analysis) showing the decisions and actions 
which took place from the time the anomaly occurred until all aspects of 
the flight were again normal; 

3. The factors and reasoning which influenced any decision to modify 
the operation if such a decision was made; 

4. The positive and negative environmental factors which may have been 
present, including those involving other personnel, hardware or software; 

5. His own opinion regarding possible causes of the anomaly, his 
analysis of the contributing factors, and conclusions he has drawn from 
the report. 

OUTLINE OF HUMAN FACTORS REPORT FORMAT 

Much of the information called for in this outline will not be relevant 
in a specific case. While the interviewer must use his best judgement, 
there are at least two reasons why detailed data should be included if there 
is any possibility that it is relevant. First, it is rarely possible to 
go back to get additional information. Second, analysis of previous studies 
and investigations, which included data presumably deemed adequate, have 
not produced answers to many critical safety questions. This outline 
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is an attempt to prepare an inclusive list of factors which may be pertinent 
in an investigation of an anomaly. It is designed to serve as a checklist 
for the investigator, and is foliated by a short summary checklist. 


OUTLINE OF PERTINENT HUMAN FACTORS DATA IN AIRCRAFT OPERATIONS 


A. Description of the occurrence 

1. Nature of the anomaly (describe the deviation from normal or 
expected performance as precisely as possible) 

2. Aircraft 

a. Make and model 

b. Configuration when anomaly occurred (gear, flaps, IAS, 
thrust, etc.) 

3. Time and location 

a. Local clock time 

b. Elapsed time since departure from blocks 

c. Phase of flight 

d. Geographic location, if pertinent 

e. Airpor t/r unway/ approach, if pertinent 

4. Radio navigation facilities in use and type of navigation 

5. Detection of the anomaly (this information should be given 
chronologically. Identify the person responsible for each 
pertinent decision, command, action, communication or inter- 
action with others. Person (s) receiving a command, a com- 
munication or interaction should also be identified.) 

a. Who first noticed the deviation? Who should have? 

b. What brought it to his attention? What should have? 

6. Cockpit environment preceding the anomaly (this refers to every- 
thing going on in the cockpit: the type of operation, the people 
present, operational constraints, physical environment, activities, 
distractions, etc., which were or might have been pertinent to 

the anomaly being described.) 

a. Who was in the cockpit''’ 

b. What was each person doing? 

c. What was the pace activity at the time? 

d_ Was there anything unusual about the operation? 

e. Were there any distractions immediately before the 
anomaly occurred? 

f. What was the weather at the time of the occurrence? 
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7. What actions immediately precede j> the anomaly, in order of 
occurrence? 

a. Did any of these actions contribute to the anomaly? 

b. What decisions motivated these actions? Who made them? 

c. If they were non-routine decisions, why were they made? 

d. What information was the basis for the decisions? Was 
the information correct? 

8, Was there any indication before the anomaly that it was going 
to occur or might occur? If so: 

a. What was the indication? 

b. Who noticed it? 

c. Was it noticed immediately? if not, why not? 


B. Recovery following the occurrence 

Note: Using the same chronological format, list each of the decisions 
made, the information which motivated them and the effect of any 
actions taken during the recovery period. Include any actions which 
did not help, or hindered, the recovery. 

X. What happened after the anonaly occurred? 

a. What decisions were made? 

b. By whom? 

c. For what reasons? 

2. What actions were taken to correct the deviation? 

a. By whom was each action initiated? When? Why? 

3. What effect did each action have? 

a. Did it help recovery? 

b. Did it hinder recovery? 

4. Did any complicating factors arise during the recovery period? 

Note: After the initial deviation, other events can occur while 
the crew is recovering from the first one. Be careful to identify 
these. 

5. Was normal operation restored? How long did it take? 
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6. Was a change in "game plan" necessary? 

a. If so, what was the original plan? What was the change? 

b. How was the change in plan implemented? 

7. Was safety threatened at any time? 

a. If so, what was the nature of the threat? 

b. Was it recognized at the time? 

c. Who recognized it? 

d. How was it recognized? 

e. How long did it last? 

f. What was done to control or minimize the threat? 

g. Could the threat have been controlled more effectively? 


C. Background 

Note: The background includes two periods: the in-flight period which 
preceded the anomaly, and the period prior to flight extending back- 
ward in time as far as necessary to encompass any medical, social or 
behavioral factors which might possibly have a bearing on the later 
occurrence of the anomaly. 

1. If pertinent, describe the history of the personnel involved and 
of the airplane and facilities utilized in this flight. Record 
any factors which might in any way have been related to the 
ancmaly or the way it was handled. 

a. Nutrition and rest: be specific. Describe meals as to 
time eaten and type of food. 

b. Were there any medical or physiological problems, 
including transient conditions? 

c. Were there any pertinent psychological factors? 

d. Describe the crew's rest and duty schedule for this 
flight sequence. Was this flight their scheduled activity? 

(1) Do the pilots believe the duty or rest schedule 
was a factor? 

(2) Describe their activities during the preceding day. 

e. Was the training or experience of any person a factor with 
respect to the conduct of the flight, the anomaly or the 
recovery? 

f. Were there any problems within the flight crew with respect 
to discipline, coordination, ability, personality factors? 

g. Were there any other personnel problems (cabin crew, ground 
support personnel, controllers, dispatch, management, others)? 

h. Were any other factors pertinent during the period prior to 
flight? 
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2. Describe in brief the history of this flight prior to the occurrence. 
Emphasize any decisions, actions, events or omissions which might 
have been related to the later anomaly. 

a. Has the airplane free of writeups or problems? 

b. Has servicing and ground support normal? 

c. Here there any supervisory problems? 

d. Here there any dispatching problems? 

e. Were there any ground or flight delays? 

f. Were there any problems at the departure airport? 

h. Were there any ATC or airways facilities problems? 

i. Was weather a problem at any time? If so, how? 

j. Was flight support normal? Adequate? 

k. Were there any other problems? 


D. Analysis and recommendations 

Note: This section should contain only the opinions and recommendations 
of the person reporting the occurrence. 

1. Was the situation evaluated correctly when the anomaly was detected? 

a. If so, were any special factors responsible? 

b. If not, why was the evaluation incorrect? 

c. Could anything have improved the accuracy of the evaluation? 

2. Was the detection of the anomaly as prompt as it should have been? 

a. If so, were any special factors responsible? 

b. If not, why was there a delay in detection? 

c. Could anything have improved the speed of detection? 

3. Was the recovery from the deviation the most effective possible? 

a. If so, were any special factors responsible? 

b. If not, why not? 

4. Was there any problem in flight crew management or coordination? 
Describe any deficiencies, problems or comments in detail. 

5. Was the entire flight managed professionally and effectively? 

a. If not, what might have been done better? 

b. Were Standard Operating Procedures, Federal Air Regulations 
or other rules or policies involved in any way? Should any 
of them be changed? If so, why? 
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6. Was Air Traffic Control involved in any way? 

a. If so, was the problem due to ATC handling or instructions? 

b. If so, was there any flight crew misunderstanding of ATC 
handling or instructions? 

c. Did ATC do anything to minimise the problem? 

7. Was any airplane system involved? 

a. Did maintenance contribute to the problem? 

b. Was enough information available? 

c. Was too much information available? 

d. Was any of the available information ambiguous or mis- 
leading? 

e. Was this a recurring problem with this specific airplane? 

With others of this type? 

f. Was a valid but recurring problem disregarded? If so, why? 

8. Was this a fairly common problem? 

9. Was pilot training adequate: 

a. To have prevented this occurrence? 

b. To correct or control it under these circumstances? 

c. To cope with it under all circumstances? 

10. Were any of the following involved in any way? If so, how? 

a. Company management? 

b. Flight crew supervision? 

c. Flight dispatch? 

d. Flight or ground support? 

e. Federal Aviation Administration? 

f. Other? 

11. Were any of the personnel or units listed under item 10 helpful 
in minimizing the threat to safety in this occurrence? 

a. If so, how? 

b. Could they have been? How? 

c. Any further recommendations in these areas? 

12. What would have had to be different to have prevented this situation? 

13. Are you doing anything differently as a result of this occurrence? 

If so, what? 

14. Do you have any additional comments or suggestions? 
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E. Interviewer supplement 

1. Was the reporting person's memory entirely clear as to the details 
of this occurrence? If not, in what area(s) did he have difficulty 
remembering details? 

2. In your opinion, did this incident pose a threat to flight safety? 

If so, how and why? 

3. Add any additional comments or opinions you may have as to the 
factors involved in this occurrence and as to measures which might 
prevent such problems in the future. 
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INTERVIEWER CHECKLIST: HUMAN FACTORS INTERVIEWS 


A. DESCRIPTION OF OCCURRENCE 

1. tlaturo of anomaly 

2. Aircraft type, configuration 

3. Where and when 

4. Navigation facilities 

5. Detection of deviation 

6. Cockpit environment 

7. Preceding actions 

S. Prior warning 

B. RECOVERY FROM ANOMALY 

1. Decisions made 

2. Actions taken 

3. Effect of each action 

4. Complicating factors 

5. Time to return to normal operation 

6. Change in "game plan" 

7. Threat to safety 

C. BACKGROUND 

1. Crew history prior to flight 

2. Schedule prior to this flight 

3. History of this flight 

4. Problems during this flight 

D. ANALYSIS BY PERSON REPORTING 

1. Detection of deviation 

2. Evaluation of situation 

3. Recovery from deviation 

4. Flight crewj recommendations 

5. Flight management, SOP, FAR 

6. ATC; recommendations 

7. Airplane systems 

8. Pilot training 

9. Management and supervision 

10. Prevention 

11. Additional comments 

E. INTERVIEWER SUPPLEMENT 

1. Memory and recall 

2. Threat to safety 

3. Interviewer analysis 
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SAMPLE HUMAN FACTORS INTERVIEW 


The following incident report was written following an interview with 
an airline pilot. It was prepared using the interview format in this chapter 
as a guide. This incident was more complex than many, but it is included 
here as an example of the sort of information which will be helpful in a 
study of human factors in aviation operations. 


THE ANOMALY 

(Nature of anomaly) Approach control vectored a wide-body jet through 
localizer course at an angle of over 90° without informing crew. (Where 
and when) The incident occurred at 2230 hrs during descent, below 10,000', 
northeast of XXX. Aircraft was being vectored for approach to runway 22. 
(Detection) Event was noted by captain, who observed full swing of localizer 
cross -pointer and ADF swing. 

(Environment) Only flight crew in cockpit? captain flying. Pace of 
activity normal until handoff to approach control, (Prior warning) Crew 
noted that controller was extremely busy. No other unusual circumstances. 
Weather IFR? no turbulence. Ground weather: KVR on rwy 22 2400’, wind 160 

at 7, braking poor to nil, slush on runway. Temperature 30° F. 

(Preceding actions) Normal descent pattern and speed reduction. No 
crew actions contributed to problem. ATC requested aircraft and a preceding 
DC-6 to slow to 150 after crossing localizer; both were unable and slowed 
to 165. 
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RECOVERY 


(Decisions, actions, effects) Contain questioned controller intentions, 
was told the maneuver was necessary for spacing. Eight miles east of local- 
izer course, approach gave a right turn from 90° to 270°. 

(Complicating factors) As aircraft again passed through localizer (a 
second anomaly), approach advised "taking you through localizer for spacing* 
left turn soon". Controller still extremely busy. He then gave a left turn 
to 220°, parallel to localizer course, cleared the flight for the approach 
and cleared it to tower frequency. Captain was unable to question the turn 
due to frequency congestion, so switched to tower. 

Autopilot was on in heading mode; captain initiated a turn to 180°, 
armed the ILS, intercepted and captured glide slope abeam the outer marker, 
and lowered landing gear, flaps and lights. Autopilot captured localizer 
inside outer marker and proceeded inbound. Tower cleared flight to land 
on runway 22. 

At 200', first officer called runway lights. Captain looked up, saw 
about 5 lights, went to manual control, turned on landing lights and almost 
immediately flew into a cloud (third anomaly) . He was momentarily dazzled 
by glare, turned lights off, saw runway clearly emerging from cloud, turned 
lights back on and prepared to land. His flare was high and rather abrupt; 
captain had difficulty seeing the wet runway surface. He landed long (he 
estimates 3000'), stopped with reverse thrust; braking was poor to nill, as 
reported . 
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(Return to normal operation) Normal operation was restored the first 
time after full ILS capture. After encountering cloud, normal operation was 
restored only at the end of the landing roll. 

(Game plan) If autopilot had not captured effectively, captain waB pre- 
pared to abandon the approach. He had "negative feelings" about going back 
for another approach under an overloaded controller, and thinks this influenced 
his decision to continue the approach after encountering cloud inside the mid- 
dle marker. 

(Threat to safety) Captain discussed his handling with ATC after landing, 
and reported the incident to company. The threat, he feels, was an overloaded 
controller resorting to non-standard procedures in an attempt to cope with 
extremely high workload. The resulting cockpit workload was lessened by the 
use of the autopilot and couplers. 

BACKGROUND 

(Prior to flight) ATC supervisor referred to a persona., problem in the 
controller; no other known pertinent factors. Flight from ZZZ was routine 
until handoff to approach control. (Crew schedule) This was the first flight 
in this duty sequence, after 4 days off. 

ANALYSIS AND RECOMMENDATIONS 

(Detection) ATC should provide warning of its intentions when non-standard 
procedures are to be used. 

(Evaluation) Situation was evaluated correctly. Knowledge of position 
would have been more precise if DME had been available at XXX. 
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(Recovery) "Recovery from final problem (cloud entry) would have been 
better if X had looked once mere at descent rate." Second officer now calls 
radar altitude from 100* to landing? this is also useful and a help in visual 
flare under these conditions. 

(ATC role) Handling was inadequate; so was information as to ATC inten- 
sions. "pilots have no way to communicate with an ATC supervisor when a con- 
troller is obviously overloaded, yet they are the ones most likely to see 
evidence of it." Captain thinks this kind of communications ability might 
help to prevent such incidents. 

(Prevention) VASI would have helped during final approach; "... I 
needed more help than I had (in flare) ..." 

INTERVIEWER SUPPLEMENT 

Memory and recall were excellent; pilot brought map as aid. The infor- 
mation appears to be reliable. 

The information was reported to company and ATC at the time. The pilot's 
conclusions are believed accurate. Standard operating procedures now include 


radar altitude callouts below 100' 


3. CLASSIFICATION OF HUMAN FACTORS IN AIRCRAFT OPERATIONS 


In the preceding sections of this working paper, we have presented 
tbj conceptual framework of and an interview method for human factors 
studies of aircraft operations. An analytic system must be able to 
extract information which can be used bo reduce the number of incidents 
and accidents due to huwan factors. Our methods are designed to produce 
an information base — a collection of data — which will allow us to 
identify at least some of the possible causes of behavioral anomalies in 
the aviation system. 

This section introduces a method of classifying reports of anomalies 
so tnat information as to factors associated with human errors can be 
easily extracted. This classification scheme does not cover the full 
scope of our analytic methods; it is designed only to describe the behavioral 
anomaly in an incident and the system or human factors associated with that 
behavior. One might liken it to a method of describing causes and effects, 
except that we cannot say, on the basis of historical data, that any effect 
was produced by any cause. At best, we can state only that factor "A" was 
associated with, or found in the presence of, effect "B" with a certain 
frequency. 

If we find that a certain effect is always, or frequently, associated 
with a particular factor, we may begin to question whether the relationship 
between them is more than casual. It is then reasonable to suspect a 
cause-and-effect relationship, chough this cannot be proved by such data. 
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For this reason, we have preferred to think of the factors found in our 
reports of operational anomalies ar. enabling factors : had they not been 
present, the anomaly probably would not have occurred > and associated 
factors ; factors which were present and pertinent to the incident under 
study, but which probably were not an essential part of the incident. 

We classify each report of an anomaly, then, in terms of the behavioral 
anomaly, or human error, which occurred, and in terms of the human or 
system factors which we believe were pertinent to that anomaly. We 
further categor/w.-i. these factors as enabling or associated on the basis 
of our review of the function analysis in each case. This categori- 
zation is necessarily a matter of judgement; by application of precise 
definitions and rules, we hope to minimize the subjective nature of such 
judgements, though it can never be eliminated. An annex to this paper 
describes the classification system in detail, discusses the rules for 
its use, and summarizes the results of preliminary interrater reliability 
tests and other studies of the method. 

The behavioral anomalies are categorized as shown in table 1, page 9. 

To recap them, they are the two intellectual functions: cognition and 
decision-making, and the four implementation functions: flight or ground 
handling, subsystem operation, subsystem monitoring, and communications 
behavior. We permit the use of one or two function descriptors, with 
a code indicating the person committing the error. 
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The enabling and associated factors are described briefly here, since 
they have not been discussed previously. It is worth mentioning again 
that our ability to categorize the factors which may play a role in an 
operational anomaly rests entirely on the completeness of the incident or 
anomaly report, and the care with which that report has been prepared. 

hardware : Several types of factors may intrude upon the smooth flow 
of an aviation operation. An aircraft component may cease to function 
properly. Similarly, a component of the ground-based tracking or computer 
system may fail. Aircraft instruments or warning systems may malfunction, 
either providing the crew with spurious information or failing to alert 
them to a real problem. The component failure may, or may not, be obvious 
to the pilot, who therefore may, or may not, take appropriate action to 
correct the defect or compensate for it. When the failure occurs in a 
system designed to provide the flight crew with information, they may or 
may not be able to verify the nature of the failure. Subsequent errors 
based on unverifiable false information may occur. Finally, in the case 
of information transfer systems, there may be no failure, but the design 
of the system may be such that the pilots receive ambiguous or misleading 
information, on which they may act properly or improperly. 

Software : Aircraft operations require a great deal of information not 
ordinarily provided by aircraft information systems. Such information 
concerns navigation, operating rules and regulations, aircraft performance 
data, and normal and emergency operating procedures and checks. This in- 
formation is normally made available by the printed word. In view of the 
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enormous volume and complexity of the informatics which must be provided, 
it is hardly surprising that flight and navigation manuals may on occasion 
contain incorrect, misleading or ambiguous data, or that the data may be 
missing or effectively missing because of inadequate or incorrect indexing. 
In such cases, the crew may be making decisions and acting upon them on 
the basis of incorrect data, or a misunderstanding of correct but ambig- 
uous data. As in the case of hardware information transfer systems, we 
attempt to differentiate between problems related to the content of the 
system, and problems related to the manner in which the information is 
presented to those who must use it. 

"Liveware": Still other types of information are provided to pilots 
by other people in the system: their fellow crew-members, air traffic 
controllers, dispatchers and other ground support personnel. Whenever 
people communicate , the possibility of a misunderstanding is always present. 
The misunderstanding may be due to a low signal-to-noise ratio, to a lack 
of common understanding of rules or phraseology by speaker and listener, 
to language problems or a variety of other factors. Similarly, pilots 
may fail to communicate their intentions clearly, leaving others in the 
system with a lack of necessary information on which to base their own 
subsequent decisions. 

Environment : Other types of factors may adversely affect the pilot, 
the airplane or the system. Environmental factors: weather, turbulence 
or restricted visibility, may perturb the vehicle or prevent the crew from 
establishing visual contact with their touchdown point. Precipitation 
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on runways may markedly affect their ability to handle the aircraft after 
touchdown. The ground environment: lighting and marking systems, or hidden 
hazards, may lead crews into errors. Toxicological or physiological hazards 
may affect both cognitive and motor function in pilots; such hazards may not 
be evident to the crew. 

Control : Those who direct and control air traffic may impose condi- 

tions or restrictions on aircraft which their crews cannot meet without 
exceedin * the airplane's operating envelope, or without decreasing their 
margin of safety. Attempts to meet such conditions may lead crews into 
errors of judgement or flight handling. 

Medical t Known or unknown acute or chronic medical problems may 
seriously interfere with a pilot's, or a controller's, decision-making 
capacity. Drugs and medications nay have similar effects. These 
factors are rarely the cole cause of a human error, but they are- often 
cited among a number of causes. Incapacitation, either obvious or 
subtle, is, of course, a constant threat to operating safety. 

Psychological factors : Psychological factors in an individual, or 
interpersonal problems within a crew, may inhibit the normal and neces- 
sary flow of information among the members of the cockpit team. Other 
psychophysiological problems such as fatigue, boredom, or overload 
caused by the rapid pace of cockpit duties may likewise be associated 
with errors in pilots; similar factors can interfere with the performance 
of air traffic controllers and others on the ground. 
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While it may be impossible to decide in retrospect whether one or 
more of these factors has caused a human error in aircraft operations, 
it is often possible to determine whether such factors were present when 
an anomaly occurred. It is sometimes possible also to determine whether 
such factors interfered with recovery from the anomaly. From such 
information, gathered and reported in sufficient detail, we may begin to 
examine the association between such factors and behavioral anomalies in 
flight operations. Our classification scheme is designed to facilitate 
this examination. 
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SUMMARY 


This working paper has attempted to provide a conceptual framework 
within which pilot and other human errors in aircraft operations may be 
studied with the intent of finding out how and why they occurred. These 
methods of collecting data on human factors in aviation appear to have 
been helpful in initial studies of operational anomalies in the aviation 
system. The authors hope that others in a position to collect such 
data will make use of this approach and will share their criticisms with 
us, so that a viable common approach to the recording of human factors 
data may be constructed. Such a system could be an immensely useful 
tool for the solution of some of our most persistent problems in civil 
aviation. 
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